The revised cGAN in ContraNet can generate reconstruction results that are strongly coupled with the conditions, i.e., the predicted labels provided by the target classifier.
We empirically verify this claim by performing targeted FGSM \(L_{\infty }\)  attack the inputs of cGAN following [1]}, where the perturbation strength ranges from \(0.01\)  to \(0.1\) . For each target attack, we generate AEs under a given perturbation budget in such a manner that the reconstructed image is optimized to be similar to the corresponding AE whenever possible. As can be observed in Figure REF , however, due to the strong correlation between the reconstruction and the predicted label, the semantics of the reconstructed images still follow the predicted label under such adaptive attacks, resulting in contradictions that can be exploited for AE detection.
<FIGURE><FIGURE>